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On behalf of the ANA, the 4A’s, the AAF, the IAB, and the NAI, thank you for the opportunity to 
provide comments on SB 5062 (“WPA”). In addition to this testimony, we have provided more detailed 
comments to you via email. We look forward to working with the Committee. 


I. Enforcement 


The WPA places sole enforcement authority within the purview of the state Attorney General. We 
strongly agree with this approach, as it would lead to strong outcomes for consumers and avoid 
unreasonable threats to businesses seeking to comply. Private right of action provisions are completely 
divorced from any connection to actual consumer harm and provide consumers little by way of protection 
from detrimental data practices. Therefore, adding a private right of action to the WPA would create a 
complex and flawed compliance system, likely flooding the courts with frivolous lawsuits driven by 
opportunistic trial lawyers searching for technical violations, rather than focusing on actual consumer 
harm or providing tangible privacy benefits for consumers. The bill should maintain enforcement 
authority exclusively vested in the state Attorney General. 


II. Browser Controls 


The WPA asks state agencies to monitor the development of universal privacy controls and requires those 
agencies to research such controls, deliver a report on their findings, and issue recommendations on the 
controls to the Governor and legislature. We strongly advise against including a mandate for controllers to 
honor controls set through or by intermediaries because a single broadcast opt out does not benefit 
consumers or business. Consumers themselves should be empowered to exercise choices over personal 
data, and they should be able to make individualized decisions regarding which controllers they wish to 
exercise those choices. 


MI. Sale Definition 


The WPA would provide Washingtonians with a right to opt out of the processing of personal data 
concerning such a consumer for purposes of targeted advertising; sales of personal data; and profiling. 
However, the bill does not clarify how the definitions of “targeted advertising” and “sale” work together. 
While the definition of “targeted advertising” correctly excludes essential ad operations that are 
imperative for the Internet to work, such as ad delivery, reporting, and ad fraud prevention, the definition 
of “sale” does not similarly exclude these essential ad operations from its scope. We ask you to update the 
WPA’s definition of “sale” to clarify that it does not cover essential ad operations. Our suggested redlines 
to the “sale” definition are set forth the detailed letter we provided to you via email. 


IV. Ad-Supported Content and Loyalty Programs 


The WPA prohibits a controller from “discriminating” against a consumer by denying goods or services 
to a consumer, charging different prices or rates for goods or services, or providing a different level of 
quality of goods and services to a consumer. This provision could eliminate publishers’ ability to offer 
consumers the choice between ad-supported content or paying a fee for the same content. To help ensure 
that Washingtonians can continue to receive the benefits of ad-supported content, and the benefits of 
loyalty and discount programs, we ask the legislature to remove the last sentence in Section 107(7) of the 
WPA. 
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vV. Data Protection Assessments (“DPAs’’) 


We oppose the requirement to provide DPAs to the Attorney General upon request because it would not 
enhance consumer protection. It would result in controllers “sanitizing” their DPAs upon creating them to 
mitigate against unreasonable scrutiny on businesses’ reasonable privacy governance decisions. 


VI. Deletion Right 


The WPA gives a consumer the right to delete personal data “concerning the consumer.” This formulation 
of the right is overly broad and is not aligned with other laws that provide similar rights in other states. 
Permitting a consumer to delete any personal data “concerning” them could extend beyond information 
that is solely associated with the one consumer making the deletion request, thereby impacting the rights 
of others. We ask the legislature to recast the right to delete in the WPA as a consumer’s right to delete 
personal data about them that the controller has collected “from” them. 


VII. Appeals 


The WPA enables consumers to appeal a controller’s refusal to act on a request to exercise the rights in 
the WPA. The bill also requires controllers to facilitate the submission of appeal records to the Attorney 
General. These requirements would force controllers to justify lawful decisions, create unpredictability in 
businesses’ execution of consumer rights requests, and obligate controllers to dedicate significant 
resources to responding to appeals without providing greater privacy protections to consumers. We ask 
you to remove the required appeal process in the WPA to foster greater certainty in businesses’ 
fulfillment of consumer rights requests and to reduce the associated excessive costs. 


